The present invention relates generally to privacy and security systems and, more particularly, to methods and systems for authorizing requests, data, informational content, applications and other information transmitted between a client device and a host device within a data processing system.
In a client/server data processing system, a number of personal computers, work stations, portable and/or handheld devices or the like (“clients”) are linked and communicate with one or more host computers (“servers”). The servers process requests from the clients for information and/or application programs shared by the clients over the network. Increasingly, client/server networks have been linked to form a wider “network of networks” including, for example, intranets and extranets that may themselves be a part of a world-wide network, namely, the World Wide Web portion of the Internet (“web”). The linking of networks permits clients to share resources (e.g., information and application programs) across the networks.
Along with an increase in the availability of shared information and application programs over potentially world-wide networks, there is an increase in the vulnerability of each of the individual client/server networks. For example, an unscrupulous person seeking to retrieve and/or damage proprietary information and application programs stored on one of the networks may access the proprietary information and application programs and use them in an unauthorized way. In an effort to prevent such an unauthorized use, many networks connect to other networks through “firewalls.” Conventional firewalls include hardware and/or software systems designed to deal with access control to internal network resources (e.g., a specific web server or a folder), to limit access to portions of a network and to prevent unauthorized retrieval or damage to proprietary information and application programs stored thereon.
Many conventional firewall systems, however, do not deal with the authorization at an application level, and may be defeated by an unscrupulous person masquerading as an authorized client. For example, many web applications assume that the application user is in fact executing a mobile agent of the application on his/her browser. However, a malicious user can connect to a web server without using standard web browser software, thus, the user is not bound to any limitations whatsoever that may be forced at the browser side, and the malicious user can masquerade as a standard client and send destructive or forged data to the web server.
In commonly assigned, U.S. patent application Ser. No. 09/345,920, a solution for verifying requests from a user of a standard HTML document is described. The solution is based on extracting the set or pattern of actions (HTTP requests) the browser software may take, based on the content of the HTML document (“authorized actions”). This set of authorized actions is then matched against requests sent by a client application. Even if the user is not using one of the standard browsers, only requests from within the legal or authorized set of actions will be passed to the web server.
In view of the foregoing, the inventors of the present invention have recognized a need to extend the above-described verification technique to logic (e.g., JavaScript programs embedded into the HTML page) executing on the client system on behalf of the web server. In particular, the inventors have recognized a need for simulating executing of client-side logic to capture and verify external data and events occurring thereon.